The present invention relates to methods and apparatus for controlling computer network security.
A packet filter can operate on the data in the network layer, to defend a trusted network from attack by an untrusted network. Packet filters can operate at the network layer to inspect fields of the TCP/IP header including, the protocol type, the source and destination IP address, and the source and destination port numbers (i.e., a five tuple classification). Disadvantages of packet filters include low level of security and poor management in large networks with complex security policies. Packet filters alone may not provide robust protection because packet filters are not aware of the context of the given communication. That is, when classifying a packet, packet filters are not concerned with the information contained within a given packet or message that a series of packets forms. In addition, packet filters do not inspect the data at the application layer making packet filters vulnerable to attempted security intrusions using the application layer.
Firewalls and intrusion detection systems are devices that are used to protect a computer network from unauthorized, malicious or disruptive users. A firewall can be used to secure a local area network from users outside the local area network. A firewall checks, routes, and can label messages sent to or from users outside the local area network. An intrusion detection system (IDS) can be used to examine information being communicated within a network to recognize suspicious patterns of behavior. Information obtained by the IDS can be used to block unauthorized or disruptive users from accessing the network. An intrusion prevention system (IPS) is an in-line version of an IDS. An IPS can be used to examine information as it is being communicated within a network to recognize suspicious patterns of behavior. A conventional network topology that includes an IPS is shown in FIG. 1a. The network 10 includes a local area network 12 coupling one or more end user work stations 14. The local area network 12 is coupled to a wide area network 16, such as the Internet. Coupled between the local area network 12 and the wide area network 16 can be an IPS 18.
A conventional IPS can have the architecture shown in FIG. 1b and include a series of functional elements. Packets are received at classification block and are processed in line through the sequence of blocks until a decision is made to allow the packet to pass or be otherwise processed (e.g., dropped). Conventional IPS 18 includes a classification block 60, a protocol decode block 62, an object extraction block 64 and a security block 66.
Classification block 60 is used to classify the packets as they arrive based on header information contained within a given packet. Typically, classification block 60 classifies packets in a manner similar to a packet filter, using the protocol type, the source and destination IP address, and the source and destination port numbers. The classification data associated with a given packet can be quickly evaluated and matched to one or more rules in a rule set. Classification block 60 can include a classification data structure that is indexed based on the classification data and includes matching rules for processing a given packet. Based on the classification, further processing of a given packet can result including passing or dropping the packet. Further processing as well can include further processing in other blocks of the IPS. The rules can include designators for special processing in one or more later blocks in the IPS, such as the security block 66.
Protocol decode block 62 can be used to decode protocol information included in the packet. The protocol information can be used to determine special handling for a packet, beyond the classification.
Object extraction block 64 can be used to buffer, construct and extract objects from the packets for special processing. For example, objects that are attached to a file in a conventional email system can be extracted for special processing (e.g., zip messages, executable files (.exe files) etc.).
Security block 66 is the final block in the IPS 18 and includes the unique security algorithms for matching. The unique security algorithms can be of the form of signatures that the IPS uses to match as against packets to detect applications at the application layer. Problematically, at this point in the IPS 18, the only processing choice for a conventional IPS 18 in the event a match is detected is to drop a given packet. No further rule checking or other special processing can be performed, for example based on the application that is detected.